kerberos-io/helm-charts
1
0
Fork 0
mirror of https://github.com/kerberos-io/helm-charts.git synced 2026-08-23 15:18:33 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
933fedc0803d58e9dcc3346f4dc7a806207475fa
helm-charts/charts/hub/values.yaml
Cédric Verstraeten 933fedc080 Merge pull request #130 from kerberos-io/feature/splash-screen-feature-flag 
feature/splash-screen-feature-flag
2026-07-31 15:35:02 +02:00

1121 lines
49 KiB
YAML
Raw Blame History

# Default values for hub.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
#######################################################
# LICENSING information: you will a license to run Hub.
# Get your license from support@kerberos.io or
# use the 8 camera license for testing.
#######################################################
license: "L/+DAwEBB2xpY2Vuc2UB/4QAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMk/4QB/gEZ/8sQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZX8DAQEHTGljZW5zZQH/gAABDAECSWQB/4IAAQNLZXkBDAABB0NvbXBhbnkBDAABB0V4cFRpbWUBBAABBERheXMBBAABB0NhbWVyYXMBBAABBVNpdGVzAQQAAQZWYXVsdHMBBAABCk1lZGlhTGltaXQBBAABCVBlcnBldHVhbAECAAEGQWN0aXZlAQIAAQlJcEFkZHJlc3MBDAAAABj/gQEBAQhPYmplY3RJRAH/ggABBgEYAAAy/4AvAQwAAAAAAAAAAAAAAAACDGZyZWUtbGljZW5zZQH81iZi6gH+AtoBEAEUARQDAQAB/gIAfeXxQb6kaPfAgOWeSAE6qEiQviFD6sciNmNfMel1mEL53FeV0GQe4cYBip9wyJag35az8A1yppxSymZD5V4my2FckyN2zmEW4E2sO/v+8eKepiAGYEzrKtfNCLxdWLmrHd0zjYQ3qk+PNfoPyzCOefeulw3aFsqBlzg9wDkF8cRx6tUW0qNTzki6sFGOuLoxS49cWqsftAvZmt+CRWa8u0VArIAjOpywN0RIZCkEYzp5RYF3LSVyWYEyvVhjE19DDnevzpJyCHRsIHTRcpTQkhboeapOdlEz8cx+PaOvxktN8hBWceTAH+nw96FARG7y6Cpjw3xo+NV1xb0tvRXGaGoK77JnErKLhd/haXji98rGvMakDt18WSbQfTVS84+Fw+/gKGsW3uS3fROAaZw1kZj4PgsEPZDvbVkCVyuS0O87UoYqpxH8S4by8cTF3wDP7FwyIRZbEbYjN2wzHSmlADYOBtdsdb1VGm7wvtB85vML9n7ZSlIpJdqfci06mGks102mDyG2LRMhUEvpUW3D/weErIvj2WiAwf6r0EUj+LO8VmAsYkME9da7FXEN6Vg/5f1u485LOpYki332RaDOhDn2eMG9DVb/HnmQSFagX+XXc/QwfsWiehCgKYGk4jQpyklTqoGu8BAt6Sm8CaoH8ngZ3cHLQT5DcZElV36/N/wA"
licenseServer:
url: ""
token: ""
###########################################################################
# # Environment: set to 'production', 'develop', 'demo', 'staging' or 'acceptance'.
# Change the environment to 'staging' or 'acceptance' will add a banner on the
# front-end, to indicate the environment.
###########################################################################
environment: "production"
isPrivate: true # Set to 'true' if this is a private deployment.
readOnly: false # Set to 'true' to halt all write operations to the database (e.g. migration, etc).
###################################################################
# Deployment mode: all | pipeline | ui
# - all: Hub services + pipeline + vault
# - pipeline: pipeline only
# - ui: Hub services only
mode: "all"
###########################################################################
# Global configuration
###########################################################################
global:
imageRegistry: ""
# Private Docker Registry: The registry secret is required if you have your Docker images behind a private registry.
# By default it will pull from Docker hub (https://hub.docker.com/r/kerberos).
#imagePullSecrets:
# - name: regcred
# Which network ingress you are using in your Kubernetes Cluster
ingress: "nginx" # or "traefik"
# A mongodb instance is required to store all the relevant metadata (this can be standalone or in a cluster).
#########################################
# Database configuration (metadata store)
#########################################
mongodb:
# MongoDB URI (for example for a SaaS service like MongoDB Atlas)
# If uri is set, the below properties are not used (host, adminDatabase, username, password)
#uri: "mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"
# Self-hosted mongodb, you could also use the uri property above.
host: mongodb.mongodb
adminDatabase: admin
authenticationMechanism: SCRAM-SHA-256
username: yourusername
password: "yourpassword"
retryWrites: "true"
# Backend engine flavor. Use "mongodb" for native MongoDB / Atlas (default)
# or "documentdb" for AWS DocumentDB. The "documentdb" flavor makes the
# hub-api disable features DocumentDB does not support (geospatial queries
# and indexes, complex $lookup pipelines, etc.). When using DocumentDB you
# should also set retryWrites: "false".
flavor: "mongodb"
###################################################
# MQTT configuration (bi-directional communication)
###################################################
# A MQTT broker (vernemq or other like mosquitto) is used to have a bi-directional communication between Agents and Hub.
# We recommend to use VernemQ (as part of this installation), but a stand-alone mosquitto broker is also possible.
mqtt:
host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Kerberos Agents and Kerberos Hub)
port: "8443"
protocol: "wss"
username: "yourusername"
password: "yourpassword"
legacy:
host: ""
port: ""
################################################################
# AMQP configuration (asynchronous processing for microservices)
#
# Usecases:
# - Hub pipeline: each time a recording is created, a message is
# send to the pipeline to process the recording.
################################################################
# We are using a pipeline that is orchestrated through Kafka topics or RabbitMQ queues
# Events are send back and forth until the processing is done.
queueProvider: "RABBITMQ" # or "KAFKA"
queueName: "kcloud-event-queue" # This is the topic to which all events are send.
# RabbitMQ can be installed in the same cluster using a helm chart, or you can
# use a service on cloud provider like AWS, GCP, Azure, etc.
rabbitmq:
host: "rabbitmq.rabbitmq:5672" # can be internal dns name or external
#host: "amqps://b-xxx-xxx-xxx-xxx-xxx.mq.eu-central-1.amazonaws.com:5671"
username: "yourusername"
password: "yourpassword"
exchange: ""
# If you already have a Kafka cluster you might use this instead of RabbitMQ.
kafka:
broker: "kafka1.yourdomain.com:9094" # can be internal dns name or external
username: "yourusername"
password: "yourpassword"
mechanism: "PLAIN"
security: "SASL_PLAINTEXT"
############################################
# TURN/STUN configuration (live streaming)
#
# Usecases:
# - WebRTC: for live streaming in full HD.
############################################
# For allowing WEBRTC a STUN and TURN server is required.
# You might want to install coturn in a seperate VM.
# -> https://help.hcltechsw.com/sametime/11.6/admin/turnserver_ubuntu.html
turn:
host: "turn:turn.yourdomain.com:8443" # this needs to be a public accessible DNS name.
username: "username1"
password: "password1"
############################################
# OpenTelemetry is used for distributed tracing and monitoring.
# More information can be found at https://opentelemetry.io/docs/
############################################
opentelemetry:
enabled: false
routingEnabled: false
collector:
# NOTE: the services use the OTLP *HTTP* exporter, so this must be the
# collector's HTTP port (4318) and must include the scheme. Use http://
# for a plaintext in-cluster collector (e.g. Jaeger) and https:// only if
# the collector terminates TLS. A scheme-less value defaults to TLS and
# fails against a plaintext collector ("server gave HTTP response to HTTPS client").
endpoint: "http://otel-collector:4318"
############################################
# OpenAI configuration (semantic search)
#
# Usecases:
# - Semantic search: search for recordings based on text.
############################################
openai:
enabled: false
apikey: "xxx"
# We have a kerberos vault component installed which contains all the
# recordings. Kerberos vault is queried to retrieve the recordings
# from the appropriate provider.
kerberosvault:
uri: "https://api.vault.yourdomain.com" # this needs to be a public accessible DNS name.
provider: "a-provider"
accesskey: "xxx"
secretkey: "xxx"
# Archiving is used when creating a task. The underlying recording of the task will be copied from its
# existing provider to the below archived provider. Seperate credentials are used, as it makes possible to
# specify another retention period.
archive:
provider: "an-archive-provider"
accesskey: "xxx"
secretkey: "xxx"
thumbnail:
provider: "a-thumbnail-provider"
accessKey: "xxx"
secretKey: "xxx"
sprite:
provider: "a-sprite-provider"
accessKey: "xxx"
secretKey: "xxx"
###########################################################################
# Administration panel for managing the Hub database (and more in future).
# For now it's used to create, edit users for Hub.
###########################################################################
admin:
repository: uugai/admin
pullPolicy: IfNotPresent
tag: "v1.3.0"
replicas: 2
# Optional pod topology spread constraints for this deployment. Empty by
# default. Example:
# topologySpreadConstraints:
# - maxSkew: 1
# topologyKey: kubernetes.io/hostname
# whenUnsatisfiable: ScheduleAnyway
# labelSelector:
# matchLabels:
# app: admin
topologySpreadConstraints: []
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 100Mi
cpu: 250m
url: "admin.yourdomain.com"
tls:
- hosts:
- "admin.yourdomain.com"
secretName: admin
oauth2Proxy:
enabled: false
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
github:
clientId: "github-client-id"
clientSecret: "github-client-secret"
cookieSecret: "generate-a-random-cookie-secret"
organization: "github-organization"
team: "github-team"
###########################################################################
# Following are all the different deployments needed to make
# Hub properly working.
kerberoshub:
# Extra environment variables like proxy to set for hub pods
extraEnv: []
# extraEnv:
# - name: HTTP_PROXY
# value: "custom_value"
serviceAccount:
# serviceAccount.create Enable creation of ServiceAccount
create: false
# If create is set to false, a name is not used in helm chart
name: ""
# additional ServiceAccount annotations
annotations: {}
labels: {}
api:
repository: ghcr.io/uug-ai/hub-api
pullPolicy: IfNotPresent
tag: "v1.9.29"
replicas: 2
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Set to false to skip rendering the hub-api Service (e.g. when an
# external/shared Service is managed elsewhere).
serviceEnabled: true
logLevel: "info" # possible values: trace, debug, info, warn, error
jwtSecret: "this-is-a-secret-please-change-to-random-string" # change to a random value, this is for generating JWT tokens.
schema: "https"
url: "api.yourdomain.com"
resources:
requests:
memory: 100Mi
cpu: 250m
limits:
memory: 100Mi
cpu: 250m
# E-mail templates
#volumeMounts:
# - name: custom-email-templates
# mountPath: /mail
#volumes:
# - name: custom-email-templates
# persistentVolumeClaim:
# claimName: custom-layout-claim
# Server-side TLS for hub-api itself (port 8081).
# When enabled, TLS_CERT_FILE and TLS_KEY_FILE are injected and
# the provided Kubernetes TLS secret is mounted read-only.
serverTLS:
enabled: false
secretName: ""
mountPath: "/etc/hub-api/tls"
certFile: "/etc/hub-api/tls/tls.crt"
keyFile: "/etc/hub-api/tls/tls.key"
# When migrating to another url, this might help migrating.
#legacyUrl: "api.legacy.yourdomain.com"
# MFA issuer name
mfaIssuer: "yourdomain.com"
# Admin API's are made available for automation of Kerberos Hub.
# To access those API's (e.g. creation of owner users), an API key needs to be provided.
apiKey: "a-random-admin-api-key"
# Default retention (in days) applied to tasks that do not have an
# explicit `retention_days` set. New tasks created without a custom
# retention are stamped with this value. Set to "0" (or a negative
# value) to disable the default retention (tasks are kept indefinitely
# unless an explicit value is provided). Must match the value used by
# `kerberoshub.cleanup.defaultTaskRetentionDays`.
defaultTaskRetentionDays: "0"
# Maximum retention (in days) allowed on a task. When a caller
# supplies an `expires_at` (or the default retention above resolves)
# beyond this cap, the value is clamped down to `now + casesMaxRetentionDays`.
# Set to "0" (or a negative value) to disable the cap (no maximum).
casesMaxRetentionDays: "0"
## Certificates
tls:
- hosts:
- "api.yourdomain.com"
secretName: kerberoshub-api
#- hosts:
# - "api.legacy.yourdomain.com"
# secretName: kerberoshub-api-legacy
- hosts:
- "admin.api.yourdomain.com"
secretName: kerberoshub-admin
language: "english"
fallbackLanguage: "english"
# Legacy (reseller) it is possible to link to AWS S3 and IAM (however Kerberos Vault is now the recommended option).
# This is primarily used for creation of subscriptions, and not needed if you are using mainly Kerberos Vault.
aws:
region: "xxx"
bucket: "xxx"
accessKey: "xxx"
secretKey: "xxx"
stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed.
privateKey: "xxx"
slack: # Slack is used in the api, to send logs to a specific Slack channel.
enabled: "true"
hook: "yourslackhook" # https://hooks.slack.com/services/T08Q2Q9V5/xxKT/JALxxAk26bHtuqTfZ
username: "Kerberos Hub" # The slack username
elasticsearch: # Logs of the kerberos hub will be send to an elastic search cluster.
enabled: "false"
protocol: "http"
host: "yourelasticsearchinstance.com"
port: "9200"
index: "kerberos-cloud"
username: ""
password: ""
sso: # OIDC settings for allowing SSO.
- domain: "uug.ai"
redirectUrl: "https://api.cloud.kerberos.io/sso/callback/uug.ai"
forceSSO: "false"
issuer: "https://xxx.eu.auth0.com/"
claimId: "email" # claim which is used to identify the user
clientId: "xxx"
clientSecret: "xxx"
clientVerificationId: "" # This is only required for SSO chaining.
extraHeaders: # Extra headers to be added to the request
- name: "x-zitadel-login-client"
value: "xxx"
- domain: "kerberos.io"
redirectUrl: "https://api.cloud.kerberos.io/sso/callback/kerberos.io"
forceSSO: "false"
issuer: "https://accounts.google.com"
claimId: "email" # claim which is used to identify the user
clientId: "xxx"
clientSecret: "xxx"
clientVerificationId: "" # This is only required for SSO chaining.
extraHeaders: []
frontend:
repository: ghcr.io/uug-ai/hub-frontend
pullPolicy: IfNotPresent
tag: "v1.9.32"
replicas: 2
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Set to false to skip rendering the hub-frontend Service (e.g. when an
# external/shared Service is managed elsewhere).
serviceEnabled: true
logLevel: "info" # possible values: trace, debug, info, warn, error
schema: "https"
url: "yourdomain.com"
resources:
requests:
memory: 50Mi
cpu: 50m
limits:
memory: 50Mi
cpu: 50m
# The front-end but in read-only mode. Set demoEnabled to true to deploy
# the demo front-end (service, ingress and deployment).
demoEnabled: false
#demoUrl: "demo.yourdomain.com"
# When migrating to another url, this might help migrating.
#legacyUrl: "legacy.yourdomain.com"
tls:
- hosts:
- "yourdomain.com"
secretName: kerberoshub
#- hosts:
# - "legacy.yourdomain.com"
# secretName: kerberoshub-legacy
#demoTls:
# - hosts:
# - "demo.yourdomain.com"
# secretName: kerberoshub-demo
# You can disable the Kerberos agent buttons, this make sense
# in a white-label setup, or where you are managing the Kerberos Agents for your customers.
hideAddAgent: "false"
# Multi tenancy (domains)
# By default the Kerberos Hub allows multi-tenancy through the concept
# of accounts and subaccounts. However through the concept of domains, you
# take it a step further. Within a domain, user accounts are unique, and are prefixed by a (domain\).
multiTenant: false
#tenantBaseDomain: "yourdomain.com" # this would resolve in following sub domain "https://domain.kerberos.io"
# Page title (browser)
title: "Kerberos Hub - Video surveillance as it should be"
# You can style Kerberos hub as you wish.
# 1. we do the styling on our side and bake it in the Docker image (change the logo attribute to your company name)
# 2. you bring your own logo (set logo to 'custom'), and mount the css file and favicons.
# we will need to include your logo in the Docker image, so please reach out to us.
logo: "custom"
# Custom layout: override css, favicons and translations (i18n)
# By providing a style.css file in the custom folder this file will override
# any css styling. Favicons are mounted into the favicon folder.
#
# Translations (i18n): for each language the served strings are
# deepMerge(assets/i18n/<lang>.json, assets/i18n-custom/<lang>.json)
# — your optional overrides layered on top of the shipped base file. To
# customise, mount a volume at assets/i18n-custom holding <lang>.json files
# with the keys you want to change. Any key you omit falls back to the shipped
# value, so keys added in future releases always render a real string (never a
# raw key) and you only maintain your diffs. Put as little or as much here as
# you like — even a complete file — but mounting at this overlay layer is
# always the safe choice, because missing keys can never leak into the UI.
# You only need files for the languages you actually customise. A partial
# example lives in custom-layout/i18n-custom/en.json; the matching complete
# files (handy to copy keys from) are published as hub-frontend release assets
# (en.json / i18n-<tag>.zip) and ship in the image at assets/i18n.
#
# (Backward compatibility: deployments that instead mount complete files over
# assets/i18n keep working, but that layer has no fallback — any key you do
# not supply shows as a raw key — so prefer assets/i18n-custom for new setups.)
#volumeMounts:
# - name: custom-layout
# mountPath: /usr/share/nginx/html/assets/custom
# - name: custom-favicon
# mountPath: /usr/share/nginx/html/assets/favicon
# - name: custom-i18n
# mountPath: /usr/share/nginx/html/assets/i18n-custom
#volumes:
# - name: custom-layout
# persistentVolumeClaim:
# claimName: custom-layout-claim
# - name: custom-favicon
# persistentVolumeClaim:
# claimName: custom-favicon-claim
# - name: custom-i18n
# persistentVolumeClaim:
# claimName: custom-i18n-claim
# Note: Front-end naming/labelling and page headings are sourced from the
# built-in internationalization files (assets/i18n/*.json) and are no
# longer configurable via the Helm chart.
# You can add custom links to the navigation bar.
navigationLinkTitle1: ""
navigationLinkUrl1: ""
navigationLinkTitle2: ""
navigationLinkUrl2: ""
navigationLinkTitle3: ""
navigationLinkUrl3: ""
navigationLinkTitle4: ""
navigationLinkUrl4: ""
navigationLinkTitle5: ""
navigationLinkUrl5: ""
caseFilterAssigneesDefault: "false"
# Enable or disable specific features and behaviours in the front-end
# Features are grouped per section / page or functionality.
features:
# General
darkModeEnabled: "true" # Enable or disable dark mode toggle 'true' or 'false'
splashScreen:
enabled: "true" # Enable or disable the pre-bootstrap splash screen 'true' or 'false'
landingPage: "/dashboard" # Landing page after login '/dashboard', '/liveview', '/media', '/devices', '/sites', '/groups'
# Internationalization (i18n): controls the runtime language behaviour
# of the front-end. When `enabled` is "false" the language switcher is
# hidden and `defaultLanguage` is always forced; users cannot change it.
i18n:
enabled: "true" # Enable or disable the language switcher 'true' or 'false'
defaultLanguage: "en" # Default language code: en, nl, pl, tr, fr, sv, de
# Case management is a feature that allows you to create cases, and link recordings, devices, sites, groups, markers and events to those cases.
case:
enabled: "true" # Enable or disable case management feature 'true' or 'false'
# Workflows allow you to define automated processes and actions in the front-end.
workflows:
enabled: "false" # Enable or disable workflows feature 'true' or 'false'
# Map tile configuration
map:
tileUrlLight: "https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png" # Map tile URL for light mode
tileUrlDark: "https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png" # Map tile URL for dark mode
attribution: "&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>" # Map attribution
# Live view page
liveview:
defaultStreamMode: "SD" # Default stream mode 'SD' or 'HD' (will be migrated to 'preview' or 'live')
liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode 'webrtc' (default) or 'hls' (firewall-friendly, no TURN required)
hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
pageSize: "6" # Max streams shown per page when paginationMode is 'numbered' (4, 8, 12, 16 or 25)
maxStreams: "-1" # Maximum number of live streams to show in live view, -1 for unlimited
# Device page
devices:
hideAgent: "false" # Hide the 'add agent' button in the front-end
# Media page
media:
filter:
date:
enabled: "true" # Enable or disable date filter in media 'true' or 'false'
sites:
enabled: "true" # Enable or disable site filter in media 'true' or 'false'
groups:
enabled: "true" # Enable or disable group filter in media 'true' or 'false'
devices:
enabled: "true" # Enable or disable device filter in media 'true' or 'false'
objectDetection:
enabled: "true" # Enable or disable object detection filter in media 'true' or 'false'
star:
enabled: "true" # Enable or disable star filter in media 'true' or 'false'
region:
enabled: "true" # Enable or disable region filter in media 'true' or 'false'
sort:
enabled: "true" # Enable or disable sort filter in media 'true' or 'false'
category:
enabled: "true" # Enable or disable category filter in media 'true' or 'false'
markers:
enabled: "true" # Enable or disable markers filter in media 'true' or 'false'
events:
enabled: "true" # Enable or disable events filter in media 'true' or 'false'
tags:
enabled: "true" # Enable or disable tags filter in media 'true' or 'false'
defaultView: "timeline" # Default view for media page 'timeline' or 'grid'
# Chart feature
chart:
colorChartSelectionFill: "rgba(132, 86, 159, 0.07)"
colorChartSelectionStroke: "rgba(132, 86, 159, 0.4)"
colorChartGridStroke: "rgba(0, 106, 255, 0.18)"
# Floor-plan feature
floorplan:
enabled: "true" # Enable or disable floorplan feature 'true' or 'false'
# Custom colors for floor-plans, update the colors of the corresponding device icons to match these
# charts/hub/custom-layout/icons.js
colorDeviceActive: "hsla(131, 31%, 52%, 1)"
colorDeviceInactive: "hsla(0, 3%, 41%, 1)"
colorDeviceIdle: "hsla(47, 86%, 47%, 1)"
colorDeviceMotion: "hsla(2, 58%, 48%, 1)"
colorLiveViewControlActive: "hsla(131, 31%, 52%, 1)" # Color for the live view control icon for an active device
colorLiveViewControlMotion: "hsla(2, 58%, 48%, 1)" # Color for the live view control icon for a device detecting motion, icon is hidden for other states
colorFloorPlanLabelText: "hsla(0, 0%, 100%, 1)"
colorFloorPlanLabelBackground: "hsla(0, 0%, 0%, 0.8)"
colorDeviceMarkerBorder: "hsla(0, 0%, 100%, 1)" # Border around the device marker circle on the map
colorTrackBox: "hsla(278, 30%, 48%, 1)" # Boxes shown on the video
colorTrackBoxHover: "hsla(47, 86%, 47%, 1)" # Boxes while hovering over the associated track
colorTrackBoxDrawing: "hsla(204, 100%, 50%, 1)" # New box while drawing
colorTrackBoxControlsDelete: "hsla(219, 100%, 94%, 1)" # Delete icon top right of the box while editing
# Video edits feature (umbrella flag for in-app video editing tools, e.g. face redaction)
videoEdits:
enabled: "false" # Enable or disable video edit tools 'true' or 'false'
# Face redaction feature
faceRedaction:
enabled: "false" # Enable or disable face redaction 'true' or 'false'
# Optional integrations
mixpanel: # We can keep track logging in Mixpanel as well
apikey: "xxx"
sentry: # We can trace errors in Sentry
url: "https://xxx@sentry.io/xxx"
stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed.
publicKey: ""
googlemaps: # Google maps is used inside the application to visualise cameras and sites.
apikey: "xxxx"
zendesk: # We can use different support tools, for now we use Zendesk but others can be integrated
url: "yourdomain.zendesk.com"
posthog: # Posthog is used for auditing and user interaction logging
key: "xxx"
url: "https://posthog.domain.com"
support:
enabled: false
oauth2Proxy:
enabled: false
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
github:
clientId: "github-client-id"
clientSecret: "github-client-secret"
cookieSecret: "generate-a-random-cookie-secret"
organization: "github-organization"
team: "github-team"
cleanup:
repository: ghcr.io/uug-ai/hub-cleanup
pullPolicy: IfNotPresent
tag: "v1.4.16"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
mode: "serve" # The mode the cleanup service operates in: serve | dry-run | version
logLevel: "info" # possible values: trace, debug, info, warn, error
maxDays: "365" # Hard maximum age (days) for global orphan cleanup.
runIntervalMinutes: "10" # Minutes between cleanup cycles.
cleanupUsernames: "" # Optional comma-separated usernames to target.
batchSize: "250" # Delete batch size per collection operation.
userBatchSize: "100" # Users processed per in-memory batch.
maxUsersPerRun: "100" # Hard cap of users processed each run.
progressEvery: "100" # Print progress every N processed users.
activeUserRescanHours: "6" # Next scan delay for active subscriptions.
inactiveUserRescanHours: "24" # Next scan delay for inactive users.
readTimeoutSeconds: "30" # Read/find/count timeout.
deleteTimeoutSeconds: "120" # Delete timeout.
reportIncludeStats: "false" # Include richer dry-run/user summary stats.
dryRun: "false" # Force dry-run behavior without using mode=dry-run.
debug: "false" # Extra per-user/global debug logging.
globalPassEnabled: "false" # Enable post-user global cleanup pass.
globalPassIntervalHours: "0" # 0 = every cycle when enabled.
globalPassDeleteBudget: "0" # 0 = unlimited deletes during global pass.
# Default retention (in days) applied to tasks without an explicit
# `retention_days`. Tasks older than this (anchored on `creation_date`)
# are deleted along with their `case_media` rows. Set to "0" (or a
# negative value) to keep tasks without an explicit retention forever.
# Tasks with `legal_hold=true` are never deleted. Must match the value
# used by `kerberoshub.api.defaultTaskRetentionDays`.
defaultTaskRetentionDays: "0"
resources:
requests:
memory: 10Mi
cpu: 10m
# hub-workflows is the standalone, queue-driven workflow engine. It consumes
# pipeline events and dispatches the stages declared in its workflow
# definitions, tracking each run in its own `workflow_runs` collection. It shares events
# (not a document) with the analysis pipeline and is meant to grow into the
# primary orchestrator. See https://github.com/uug-ai/hub-workflows.
workflows:
# Disabled by default. When enabled, the analysis service tees each
# classify result to this service (via WORKFLOWS_ENABLED on pipe-analysis)
# in parallel with the normal throttler/notification tail, which still runs
# unchanged. Flip to true to run the workflows engine.
enabled: false
# This block is purely behaviour: the master switch above plus the workflow
# definitions below. The engine's own deployment (image/tag/replicas/queue/
# resources) lives under kerberoshub.services.workflows, in the same uniform
# shape as the stage workers it dispatches to.
#
# -----------------------------------------------------------------------
# Global workflow definitions — the named workflows the engine runs.
#
# `definitions` is the engine's single routing source: several distinct
# workflows can run over one recording, each opening its own run and
# dispatching only its own stages. It is a MAP keyed by workflow name (names
# are unique and merge cleanly across -f / --set overrides). Ships empty; the
# commented block is a worked example of an object-tracking + loitering
# pipeline. Add more keys to run more workflows.
#
# Each definition:
# enabled include this workflow (soft-delete toggle).
# source always rendered as "config" (a Helm-seeded, ops-managed,
# deployment-global workflow — read-only in the API).
# triggers how a run OPENS. Omit for a single bare automatic trigger
# (opens for every recording); the per-stage `needs` then decide
# which stages FIRE. Narrow with device/schedule triggers, e.g.
# `- {type: automatic, devices: [{key: <device-key>}]}`.
# stages the executable stages, each {operation, dispatch?, needs?,
# needsMode?}. dispatch is "always" (default) or "conditional";
# a conditional stage's `needs` are upstream dependencies, each
# {operation?, condition?} — operation is the readiness GATE (the
# upstream op whose data must be present before the condition is
# read; omit for a check on the run root itself), condition is
# {path, op, value} where path is ABSOLUTE from the run root and
# resolves through string-keyed maps only (it cannot index into
# arrays). needsMode combines multiple needs: "any" (default;
# fire on the first match) or "all" (a join; fire once every need
# has resolved and matched). The queue is taken from the matching
# services.<operation> entry, so dispatch and consume cannot drift.
#
# Every stage `operation` must have a deployed worker under
# kerberoshub.services.<operation> (deploy the objecttracking / loitering
# workers below).
definitions: {}
#tracking-workflow:
# enabled: true
# triggers:
# - type: automatic
# stages:
# - operation: objecttracking
# dispatch: always
# - operation: loitering
# dispatch: conditional
# # Fire loitering once objecttracking has resolved — a readiness join
# # (no condition ⇒ gate on the upstream's presence, not a value).
# needs:
# - operation: objecttracking
# Workflow deployments. Every workflows-subsystem Deployment's image/tag/
# replicas/resources/queue lives here in a single, uniform shape:
# - `workflows` is the engine itself (the orchestrator). It is deployed
# whenever kerberoshub.workflows.enabled is true and has no `enabled` of
# its own — the master switch already gates the whole subsystem.
# - every other entry is a stage worker the engine dispatches to. A worker
# consumes its own queue and routes its result back to the engine queue.
# Deploying a worker (services.<name>.enabled) is independent from routing
# to it (a workflows.definitions stage of the same operation) — it runs only
# when its own `enabled` is true AND the workflows engine is enabled.
services:
# hub-workflows — the workflows engine (orchestrator). Consumes the engine
# queue, evaluates the workflow definitions (WORKFLOW_DEFINITIONS) and
# dispatches to the stage workers below. Deployed when workflows.enabled is
# true; it has no separate `enabled` here.
workflows:
repository: ghcr.io/uug-ai/hub-workflows
pullPolicy: IfNotPresent
tag: "v1.0.0"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
# Queue this service consumes ingest events and upstream results from
# (WORKFLOWS_QUEUE). Must be fed the same messages the analysis service sees.
queue: "hub-workflows-queue"
resources:
requests:
memory: 10Mi
cpu: 10m
# ---------------------------------------------------------------------
# EXAMPLE custom stage worker (commented out) — hub-loitering.
#
# Companion deployment for the workflows.definitions example above (the
# loitering stage of tracking-workflow). Uncomment to deploy the demo
# worker. It ships as its own repository/module.
# See https://github.com/uug-ai/hub-loitering.
#loitering:
# # Deploy the hub-loitering worker.
# enabled: true
# repository: ghcr.io/uug-ai/hub-loitering
# pullPolicy: IfNotPresent
# tag: "v1.0.0"
# replicas: 1 # Number of pods for the worker.
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# #volumes:
# # - name: extra
# # emptyDir: {}
# #volumeMounts:
# # - name: extra
# # mountPath: /data
# logLevel: "info" # possible values: trace, debug, info, warn, error
# # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
# # same value is taken into the matching workflows.definitions stage, so the
# # engine dispatches and the worker consumes the same queue with no drift.
# # Convention: "kcloud-<operation>-queue.fifo".
# queue: "kcloud-loitering-queue.fifo"
# resources:
# requests:
# memory: 10Mi
# cpu: 10m
# ---------------------------------------------------------------------
# EXAMPLE stage worker (commented out) for the workflows.definitions example
# above — hub-objecttracking. Uncomment the worker whose operation a
# definition references, so the engine dispatches and the worker consumes the
# same queue with no drift.
#objecttracking:
# # Deploy the object-tracking worker (operation "objecttracking").
# enabled: true
# repository: ghcr.io/uug-ai/hub-objecttracking
# pullPolicy: IfNotPresent
# tag: "v1.0.0"
# replicas: 1 # Number of pods for the worker.
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# logLevel: "info" # possible values: trace, debug, info, warn, error
# # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
# queue: "kcloud-objecttracking-queue.fifo"
# resources:
# requests:
# memory: 10Mi
# cpu: 10m
monitordevice:
repository: ghcr.io/uug-ai/hub-monitor-device
pullPolicy: IfNotPresent
tag: "v1.4.0"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 10Mi
cpu: 10m
# E-mail templates
#volumeMounts:
# - name: custom-email-templates
# mountPath: /mail
#volumes:
# - name: custom-email-templates
# persistentVolumeClaim:
# claimName: custom-layout-claim
reactivate:
repository: uugai/hub-reactivatesubscriptions
pullPolicy: IfNotPresent
tag: "v1.0.2"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 10Mi
cpu: 10m
forwarder:
enabled: false
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
#repository: kerberos/vault-forwarder
#pullPolicy: IfNotPresent
#tag: "1.0.2732389692"
#resources:
# requests:
# memory: 10Mi
# cpu: 10m
# This proxy is legacy for the old agent, will be migrated in the new Hub API.
proxy:
repository: uugai/hub-proxy
pullPolicy: IfNotPresent
tag: "v1.0.0"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 10Mi
cpu: 10m
# The Kerberos Hub pipeline is a series of microservices that process the recordings.
# Each microservice is responsible for a specific task, like counting objects, generating thumbnails, etc.
# The pipeline is orchestrated through Kafka topics or RabbitMQ queues.
# The pipeline is a critical component of Kerberos Hub, and should be monitored closely.
kerberospipeline:
event:
repository: ghcr.io/uug-ai/hub-pipeline-event
pullPolicy: IfNotPresent
tag: "v1.3.0"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 10Mi
cpu: 10m
monitor:
repository: ghcr.io/uug-ai/hub-pipeline-monitor
pullPolicy: IfNotPresent
tag: "v1.3.10"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
resources:
requests:
memory: 10Mi
cpu: 10m
sequence:
repository: ghcr.io/uug-ai/hub-pipeline-sequence
pullPolicy: IfNotPresent
tag: "v1.6.18"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
resources:
requests:
memory: 10Mi
cpu: 10m
throttler:
repository: uugai/hub-pipeline-throttler
pullPolicy: IfNotPresent
tag: "v1.2.0"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 10Mi
cpu: 10m
notify:
repository: ghcr.io/uug-ai/hub-pipeline-notification
pullPolicy: IfNotPresent
tag: "v1.3.9"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 10Mi
cpu: 10m
# E-mail templates
#volumeMounts:
# - name: custom-email-templates
# mountPath: /mail
#volumes:
# - name: custom-email-templates
# persistentVolumeClaim:
# claimName: custom-layout-claim
notifyTest:
repository: uugai/hub-pipeline-notification-test
pullPolicy: IfNotPresent
tag: "v1.2.1"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
resources:
requests:
memory: 10Mi
cpu: 10m
# E-mail templates
#volumeMounts:
# - name: custom-email-templates
# mountPath: /mail
#volumes:
# - name: custom-email-templates
# persistentVolumeClaim:
# claimName: custom-layout-claim
analysis:
repository: ghcr.io/uug-ai/hub-pipeline-analysis
pullPolicy: IfNotPresent
tag: "v1.7.17"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
resources:
requests:
memory: 10Mi
cpu: 10m
dominantColor:
repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
pullPolicy: IfNotPresent
tag: "v2.0.2"
replicas: 3 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn,
resources:
requests:
memory: 512Mi
cpu: 500m
limits:
memory: 2Gi
cpu: 1000m
thumbnail:
repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
pullPolicy: IfNotPresent
tag: "v1.3.6"
replicas: 2 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn, error
quality: "1" # 1 (best) - 31 (worst)
width: "600"
height: "-1"
kerberosvault:
enabled: true # If you want to use Kerberos Vault to store the thumbnails
resources:
requests:
memory: 512Mi
cpu: 500m
limits:
memory: 2Gi
cpu: 1000m
counting:
repository: uugai/hub-pipeline-counting
pullPolicy: IfNotPresent
tag: "v1.6.3"
replicas: 1 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn,
resources:
requests:
memory: 10Mi
cpu: 10m
sprite:
enabled: false # Enable or disable the sprite generation 'true' or 'false
repository: ghcr.io/uug-ai/hub-pipeline-sprite
pullPolicy: IfNotPresent
tag: "v1.1.14"
replicas: 5 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
# Optional extra volumes / volumeMounts for this deployment (empty = none).
#volumes:
# - name: extra
# emptyDir: {}
#volumeMounts:
# - name: extra
# mountPath: /data
logLevel: "info" # possible values: trace, debug, info, warn,
interval: "1" # Number of secondes between each thumbnail in the sprite
width: "240" # Should not be changed for the moment (hard coded in UI)
height: "135" # Should not be changed for the moment (hard coded in UI)
resources:
requests:
memory: 512Mi
cpu: 500m
limits:
memory: 2Gi
cpu: 1000m
export:
repository: ghcr.io/uug-ai/hub-pipeline-export
pullPolicy: IfNotPresent
tag: "v1.2.8"
replicas: 2 # Number of pods for the service.
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
logLevel: "info" # possible values: trace, debug, info, warn, error
# playerAssetsPath: "/custom/player-assets/" # Path to custom player.html template (overrides the embedded default)
# volumeMounts:
# - name: custom-player-assets
# mountPath: /custom/player-assets
# volumes:
# - name: custom-player-assets
# configMap:
# name: custom-player-html
resources:
requests:
memory: 10Mi
cpu: 10m
###########################################################################
# Email configuration
#
# Preferred email provider, we support mailgun and smtp.
# Email templates are used to send out emails to users.
###########################################################################
email:
provider: "mailgun"
from: "support@yourdomain.com"
displayName: "yourdomain.com"
mailgun:
domain: "mg.yourdomain.com"
apikey: "xxxx"
smtp:
server: "smtp.yourdomain.com"
port: "465"
username: "yourusername"
password: "yourpassword"
templates:
welcome: "welcome"
welcomeTitle: "Welcome to Kerberos Hub"
activate: "activate"
activateTitle: "Wonderful! Your Kerberos Hub is now active"
forgot: "forgot"
forgotTitle: "Password reset Kerberos Hub. You forgot your password"
share: "share"
shareTitle: "[Action] You received a recording from Kerberos Hub"
caseShare: "share_case"
caseShareTitle: "[Action] A case has been shared with you on Kerberos Hub"
caseShareOtp: "share_case_otp"
caseShareOtpTitle: "Your Kerberos Hub verification code"
assignTask: "assign_task"
assignTaskTitle: "[Action] You've been assigned to a task"
detection: "detection"
disabled: "disable"
highupload: "highupload"
device: "device"
alertTitle: "[Alert] Kerberos Hub detected something an event"
deviceTitle: "[Device] A Kerberos Agent's status has been changed"
Reference in New Issue View Git Blame Copy Permalink